Microsoft’s September security release fixes two Windows vulnerabilities that Microsoft says attackers were already exploiting. Successful exploitation lets a local attacker elevate privileges to SYSTEM. The flaws affect different Windows generations: CVE-2026-85880 reaches older Windows 10 and Windows Server branches through Advanced Local Procedure Call, while CVE-2026-81963 sits in the Windows Update Stack used by current Windows 11 releases and Windows Server 2025.
Microsoft marked exploitation detected for the ALPC flaw and did the same for the Update Stack flaw. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on September 8 and set a September 22 remediation deadline for federal civilian agencies. Neither organization identified the attackers, victims, targeted sectors, exploited builds, or an initial-access method.
Two local paths reach SYSTEM
Both vulnerabilities are post-compromise elevation paths. They do not provide unauthenticated remote entry by themselves. Microsoft’s CVSS vectors require local access and low privileges, with no user interaction. Each carries a base score of 7.8.
CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC. Microsoft says a low-privilege process running inside an AppContainer can exploit the flaw locally, escape the sandbox, and elevate privileges. The advisory credits Mark Kelly, David Galazin, and Jeremy Hedges of Proofpoint, along with Volexity.
CVE-2026-81963 is an improper link-resolution flaw in Windows Update Stack. Microsoft disclosed less about its exploitation path, but describes an authorized local attacker reaching SYSTEM. The advisory credits Romain Deperne and Microsoft Threat Intelligence Center.
The outcome is explicit in both records. Microsoft writes, “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.”
Figure details
The left path starts with code in a low-privilege AppContainer and passes through the ALPC heap-based buffer overflow in CVE-2026-85880. The right path starts with an authorized local attacker and passes through the Windows Update Stack link-following flaw in CVE-2026-81963. Both paths converge on SYSTEM privileges. The figure does not depict initial access because Microsoft did not disclose how attackers first reached the affected hosts.
Fixed builds split by release
The affected-product lists do not overlap. Teams therefore need to test each Windows branch against the build floor attached to the applicable CVE, rather than treating one version number as a fleet-wide answer.
| Vulnerability | Windows release | First fixed build |
|---|---|---|
CVE-2026-85880 | Windows Server 2012 | 6.2.9200.26349 |
CVE-2026-85880 | Windows Server 2012 R2 | 6.3.9600.23397 |
CVE-2026-85880 | Windows 10 1607 and Windows Server 2016 | 10.0.14393.9512 |
CVE-2026-85880 | Windows 10 1809 and Windows Server 2019 | 10.0.17763.9245 |
CVE-2026-85880 | Windows 10 21H2 | 10.0.19044.7725 |
CVE-2026-85880 | Windows 10 22H2 | 10.0.19045.7725 |
CVE-2026-85880 | Windows Server 2022 | 10.0.20348.5622 |
CVE-2026-81963 | Windows 11 23H2 | 10.0.22631.7582 |
CVE-2026-81963 | Windows 11 24H2 | 10.0.26100.9445 |
CVE-2026-81963 | Windows 11 25H2 | 10.0.26200.9445 |
CVE-2026-81963 | Windows 11 26H1 | 10.0.28000.2954 |
CVE-2026-81963 | Windows Server 2025 | 10.0.26100.33438 |
Those floors cover the architectures and Server Core variants in Microsoft’s product trees. Microsoft labels customer action as required and maps every affected branch to a September security update or monthly rollup.
Exploitation details remain withheld
The two disclosures establish exploitation, but they do not publish a campaign narrative. There are no CVE-specific file hashes, filenames, process chains, commands, registry paths, domains, IP addresses, log signatures, or detection procedures in the primary record. CISA lists known ransomware use as unknown and marks forensic triage as No for both catalog entries.
That leaves a material incident-response blind spot. A vulnerable build establishes exposure, while a fixed build establishes that the affected code was replaced. Neither result proves whether exploitation occurred before the update. Defenders will need further Microsoft, CISA, or researcher disclosure to turn these CVEs into a specific compromise hunt.
Measure every branch after rollout
Inventory Windows edition, release, architecture, and OS build before assigning the update. Compare each host with the matching floor above, then deploy the Microsoft update that supplies that build. Prioritize any applicable host below its fixed floor because both flaws are confirmed post-compromise elevation routes and the public record does not reveal the initial-access path.
After deployment, query the installed OS build again and require every in-scope host to meet or exceed its branch-specific floor. Also retain the pre-update build and installation time in the change or endpoint record. The expected remediation result is a complete inventory with no applicable host below its fixed build and no unsupported branch silently omitted.
That test verifies patch state. It cannot clear a host of compromise. Until CVE-specific recognition evidence appears, incident decisions must rest on existing endpoint telemetry and the surrounding intrusion evidence rather than a hunt invented from these sparse advisories.